Message-ID: <C512D71F19BD044484491EC71DBE7FF17FD348@TORXMB03.corp.amvescap.net>
Date: Tue, 23 Nov 2004 09:12:01 -0600
From: "Sherlock, Nathan" <Nathan.Sherlock@...trimark.com>
To: customer service mailbox <customerservice@...fense.com>,
	bugtraq@...urityfocus.com, vulnwatch@...nwatch.org
Subject: RE: iDEFENSE Security Advisory 11.22.04: Sun Java Plugin Arbitrar
	y Package Access Vulnerability


The workaround mentions the Microsoft Java Virtual Machine (MSJVM).

Note that MSJVM will reach its end of life on December 31, 2007 -
http://www.microsoft.com/mscorp/java/.

Microsoft is encouraging developers to transition away from MSJVM.

Regards,
Nathan

-----Original Message-----
From: customer service mailbox [mailto:customerservice@...fense.com] 
Sent: Monday, November 22, 2004 1:18 PM
To: bugtraq@...urityfocus.com; vulnwatch@...nwatch.org
Subject: iDEFENSE Security Advisory 11.22.04: Sun Java Plugin Arbitrary
Package Access Vulnerability

Sun Java Plugin Arbitrary Package Access Vulnerability

iDEFENSE Security Advisory 11.22.04
www.idefense.com/application/poi/display?id=158&type=vulnerabilities
November 22, 2004

I. BACKGROUND

Java Plug-in technology, included as part of the Java 2 Runtime Environment,
Standard Edition (JRE), establishes a connection between popular browsers
and the Java platform. This connection enables applets on Web sites to be
run within a browser on the desktop. More information about Java Plug-in
technology is available from http://java.sun.com/products/plugin/.

II. DESCRIPTION

Remote exploitation of a design vulnerability in Sun Microsystems Inc.'s
Java Plug-in technology allows attackers to bypass the Java sandbox and all
security restrictions imposed within Java Applets.

A number of private Java packages exist within the Java Virtual Machine
(VM) and are used internally by the VM. Security restrictions prevent
Applets from accessing these packages. Any attempt to access these packages,
results in a thrown exception of 'AccessControlException', unless the Applet
is signed and the user has chosen to trust the issuer.

The problem specifically exists within the access controls of the Java to
Javascript data exchange in web browsers using Sun's Java Plug-in
technology. The vulnerability allows Javascript code to load an unsafe class
which should not normally be possible from a Java Applet.

III. ANALYSIS

Successful exploitation allows remote attackers to execute hostile Applets
that can access, download, upload or execute arbitrary files as well as
access the network. A target user must be running a browser on top of a
vulnerable Java Virtual Machine to be affected. It is possible for an
attacker to create a cross-platform, cross-browser exploit for this
vulnerability. Once compromised, an attacker can execute arbitrary code
under the privileges of the user who instantiated the vulnerable browser.

IV. DETECTION

iDEFENSE has confirmed the existence of this vulnerability in Java 2
Platform, Standard Edition (J2SE) 1.4.2_01 and 1.4.2_04 from Sun
Microsystems. It is suspected that earlier versions are vulnerable as well.
Various browsers such as Internet Explorer, Mozilla and Firefox on both
Windows and Unix platforms can be exploited if they are running a vulnerable
Java Virtual Machine.

V. WORKAROUND

Disabling Java or JavaScript will prevent exploitation as the vulnerability
relies on the data transfer between the two components.
Other Java Virtual Machines, such as the Microsoft VM, are available and can
be used as an alternative.

VI. VENDOR RESPONSE

This issue has been fixed in J2SE v 1.4.2_06 available at:

   http://java.sun.com/j2se/1.4.2/download.html

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CAN-2004-1029 to this issue. This is a candidate for inclusion in the CVE
list (http://cve.mitre.org), which standardizes names for security problems.

VIII. DISCLOSURE TIMELINE

06/29/2004   Initial vendor notification
06/30/2004   Initial vendor response
08/16/2004   iDEFENSE clients notified
11/22/2004   Public disclosure

IX. CREDIT

Jouko Pynnonen (jouko[at]iki.fi) is credited with this discovery.

Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp

X. LEGAL NOTICES

Copyright (c) 2004 iDEFENSE, Inc.

Permission is granted for the redistribution of this alert electronically.
It may not be edited in any way without the express written consent of
iDEFENSE. If you wish to reprint the whole or any part of this alert in any
other medium other than electronically, please email
customerservice@...fense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate at
the time of publishing based on currently available information. Use of the
information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the author
nor the publisher accepts any liability for any direct, indirect, or
consequential loss or damage arising from use of, or reliance on, this
information.

-----------------------------------------
Confidentiality Note:  The information contained in this message, and any
attachments, may contain confidential and/or privileged material.  It is
intended solely for the person or entity to which it is addressed.  Any
review, retransmission, dissemination, or taking of any action in reliance
upon this information by persons or entities other than the intended
recipient is prohibited.  If you received this in error, please contact the
sender and delete the material from any computer.     Note relative à la
confidentialité : L'information contenue dans ce message, ainsi que dans
toute pièce jointe, peut comporter des renseignements confidentiels et/ou
privilégiés. Le message est réservé exclusivement à la personne physique ou
morale à laquelle il est adressé. Il est interdit à quiconque n'est pas le
destinataire visé d'examiner, de retransmettre ou de diffuser ce message,
ou de prendre quelque mesure que ce soit sur la foi des renseignements qui
y figurent. Si vous avez reçu ce message par erreur, veuillez communiquer
avec l'expéditeur et supprimer le document de tout ordinateur.

Powered by blists - more mailing lists